15 lines
1.2 KiB
Markdown
15 lines
1.2 KiB
Markdown
# Tip #13 — Role separation: editor vs moderator vs admin
|
|
|
|
**Date:** 2026-06-24
|
|
**Category:** security
|
|
**Source:** MC-Survival Wiki Daily Tip (backfilled from state.json)
|
|
## Role separation: editor vs moderator vs admin
|
|
|
|
Split the single 'admin' role in Better Auth into four tiers (ADMIN, MODERATOR, EDITOR, USER) backed by a small permissions.ts matrix, and expose a typed can(action) helper through the existing use-auth.ts hook. It solves the too-coarse-grained problem: today anyone with the 'admin' flag can do anything, which means we either give out too much access or not enough. The signal is the editorial roadmap: we are about to invite moderators, and we need a clean way to say 'you can edit and soft-delete, but you cannot change roles'. A permission matrix is the right shape because it scales to new actions without restructuring the role enum, and the can() helper makes the call sites read like English.
|
|
|
|
## Implementation tips
|
|
|
|
1. Better Auth roles: ADMIN, MODERATOR, EDITOR, USER. Permission matrix in a small permissions.ts map.
|
|
2. MODERATOR can edit + soft-delete. EDITOR can edit but not delete. ADMIN manages roles + sees audit log.
|
|
3. Update the existing use-auth.ts hook to expose a typed role + a can(action) helper.
|